Skip to content

fix(deps): add ajv override >=8.18.0 (GHSA-2g4f-4pwh-qvx6, CVE-2025-69873)#140

Closed
cswkim wants to merge 2 commits intomainfrom
fix/GHSA-2g4f-4pwh-qvx6
Closed

fix(deps): add ajv override >=8.18.0 (GHSA-2g4f-4pwh-qvx6, CVE-2025-69873)#140
cswkim wants to merge 2 commits intomainfrom
fix/GHSA-2g4f-4pwh-qvx6

Conversation

@cswkim
Copy link
Owner

@cswkim cswkim commented Feb 20, 2026

Description

Adds a pnpm override for ajv at >=8.18.0 and refreshes the lockfile. Versions before 8.18.0 are affected by GHSA-2g4f-4pwh-qvx6 / CVE-2025-69873: ReDoS when the $data option is enabled and a malicious regex pattern is passed via the pattern keyword, which can cause long CPU blocking and DoS. The override forces all dependents to use the patched release.

Checklist

  • It's useful if your PR references an issue where it is discussed ahead of time
  • Adhere to semantic messaging and prefix your PR title with feat:, fix:, chore:, docs:, etc.
  • I’ve added tests if needed
  • I’ve updated documentation if applicable
  • I’ve tested this locally
  • Add a changeset (pnpm changeset) if necessary

Tests and linting

  • Run the tests with pnpm test.
  • Run the lint check with pnpm lint.
  • Run the code formatting (prettier) check with pnpm format.

@changeset-bot
Copy link

changeset-bot bot commented Feb 20, 2026

🦋 Changeset detected

Latest commit: de15fa2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
discogs-mcp-server Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@cswkim cswkim closed this Feb 20, 2026
@cswkim cswkim deleted the fix/GHSA-2g4f-4pwh-qvx6 branch February 20, 2026 17:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant